111314 matches found
Podlove Podcast Publisher 4.5.1 Shell Upload
A proof of concept exploit for an unauthenticated arbitrary file upload vulnerability leading to remote code execution in Podlove Podcast Publisher version 4.5.1. The vulnerability uses inconsistent parsing of an attacker-controlled source URL, allowing a GIF/PHP polyglot to pass file-type...
CVE-2026-72551: Improper Neutralization of Special Elements used in an OS Command
A remote code execution vulnerability in Apioo Fusio 8.8.3 allows authenticated users with the Developer role to execute arbitrary OS commands by exploiting a PHP-Sandbox allow-list bypass. The sandbox allow-list permits functions that transitively invoke system, enabling a developer to escape th...
CVE-2026-72557: Unrestricted Upload of File with Dangerous Type
An unrestricted file upload vulnerability in Cockpit CMS 2.6.0 allows authenticated users to upload files of any extension including PHP scripts via the asset upload endpoint. The alloweduploads configuration defaults to wildcard and uploaded files are stored in a web-accessible directory. An...
CVE-2026-72778: Improperly Controlled Modification of Dynamically-Determined Object Attributes
Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control panel element-search condition handling. Craft cleanses the outer request-controlled condition array via Component::cleanseConfig, but...
CVE-2026-55676: Unrestricted Upload of File with Dangerous Type
Malcolm is a network traffic analysis tool suite. The file-upload component FilePond PHP backend accepts uploads at POST /server/php/submit.php and stores them in a directory served by the same nginx and php-fpm instance. The allow-list that should restrict accepted file types is an empty array b...
PT-2026-70131
Name of the Vulnerable Software and Affected Versions ZoneMinder version 1.39.17 Description An authenticated user can execute OS commands due to a broken permission check within the Filter class. The canEdit and canDelete functions call nonexistent methods on the ZMUser class, which triggers the...
CVE-2026-72556: Improper Neutralization of Special Elements used in an OS Command
A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the Filter class. The canEdit and canDelete methods invoke nonexistent methods on the ZM\User class, causing PHP call to return a truthy valu...
CLSA-2026-1786399295 TuxCare security update for symfony/yaml (1 CVE)
TuxCare rebuilt symfony/yaml to address 1 CVE. Fixed in v2.8.52-p2+tuxcare...
pt-platform__DVWA
DAMN VULNERABLE WEB APPLICATION Damn Vulnerable Web Applicati...
EUVD-2026-55800
Cachet through 2.4.1 contains a server-side template injection vulnerability in incident template rendering that allows authenticated users to execute arbitrary PHP code. Attackers can create malicious incident templates with Blade directives or Twig filters that execute system commands when...
CVE-2026-69118 Cachet 2.4.1 Authenticated Server-Side Template Injection RCE
Cachet through 2.4.1 contains a server-side template injection vulnerability in incident template rendering that allows authenticated users to execute arbitrary PHP code. Attackers can create malicious incident templates with Blade directives or Twig filters that execute system commands when...
Updated php8.4 packages fix security vulnerabilities
The updated php 8.4 packages fix some security vulnerabilities. See the references for more information...
Updated php8.5 packages fix security vulnerabilities
Updated php 8.5 packages fix some security vulnerabilities. For details see the references...
Imperva Customers Protected Against XSS2Shell (CVE-2026-64638) in WordPress Core
TL;DR: CVE-2026-64638, dubbed XSS2Shell, is a high-severity WordPress Core vulnerability that begins as a pre-authentication reflected XSS on the login screen and can be chained to PHP code execution when a logged-in administrator is successfully targeted. WordPress fixed the issue in 7.0.3 and...
CVE-2026-66738
SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...
CVE-2026-66738
SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...
EUVD-2026-55655
SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...
CVE-2026-66738
SPIP prior to 4.4.18 on SQLite-backed installations contains a code injection vulnerability in the navigation endpoint. The endpoint mishandles array-typed user input, bypasses input sanitization, and can break out of a PHP-quoted string context, enabling an authenticated attacker (minimum editor...
CVE-2026-66738 SPIP < 4.4.18 Code Injection via Navigation Endpoint on SQLite
SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...